[LEGIT] Fix - js/polynomial-redos

[liorn-test-app]

🔍 The problem

Polynomial regular expression used on uncontrolled data
See issue in Legit

🔒 Fix Details

Fixed a Regular Expression Denial of Service (ReDoS) vulnerability in email validation. The EMAIL_RE regex was applied directly to user-controlled input without length constraints, allowing attackers to craft malicious email strings that could cause catastrophic backtracking and block the Node.js event loop. Added a length check limiting email input to 254 characters (per RFC 5321) before regex evaluation. This bounds the input size and prevents exponential backtracking time, mitigating the DoS risk while maintaining the existing validation logic.

--- a/app/routes/session.js
+++ b/app/routes/session.js
@@ -163,6 +163,10 @@
             return false;
         }
         if (email !== "") {
+            if (email.length > 254) {
+                errors.emailError = "Invalid email address";
+                return false;
+            }
             if (!EMAIL_RE.test(email)) {
                 errors.emailError = "Invalid email address";
                 return false;
@@ -193,7 +197,6 @@
                 }
 
                 userDAO.addUser(userName, firstName, lastName, password, email, (err, user) => {
-
                     if (err) return next(err);
 
                     //prepare data for the user

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud